GigaWiper (BLUERABBIT): Golang Backdoor Bundling Physical-Disk Wiping, Crucio-Derived Fake Ransomware, and FlockWiper-Derived Multi-Pass Wiping — Threadlinqs Intelligence
As of 2026-07-13, GigaWiper (BLUERABBIT): Golang Backdoor Bundling Physical-Disk Wiping, Crucio-Derived Fake Ransomware, and FlockWiper-Derived Multi-Pass Wiping is a high-severity malware threat attributed to BLUERABBIT (Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 32 indicators of compromise.
Threat ID: TL-2026-1271 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: BLUERABBIT · Iran · DESTRUCTION
Microsoft Threat Intelligence identified GigaWiper, a Go-based backdoor active since October 2025 that fuses a standalone physical-disk wiper, a Crucio-ransomware-derived unrecoverable file-encryption
GigaWiper is a modular, Golang-compiled backdoor first observed conducting destructive wiping activity in October 2025 and publicly disclosed by Microsoft on 2026-07-09. It is architecturally distinctive for consolidating THREE previously distinct malware lineages into a single 20-command implant rather than deploying them as separate tools: (1) a standalone physical-disk wiper that is code-identical to the backdoor's own Command 1/WipeMain, suggesting the wiper was cannibalized into the backdoor or vice versa; (2) a file-encryption/destruction command (Command 3, internally named RanMain/BigBangExtortMain) whose code traces to Crucio ransomware, a malware family a December 2023 CISA advisory attributed to IRGC-affiliated cyber actors following attacks on US, UK, Irish, and Israeli water and energy infrastructure; and (3) a multi-pass secure-wipe command (Command 12, WipeCMain) that is a Golang reimplementation of FlockWiper, a C-language wiper that first surfaced on VirusTotal in June 2025, months before GigaWiper's own operational debut.
Attribution linkage across the three lineages rests on shared function naming (BigBangExtortMain appears in both Crucio and GigaWiper), identical code flow, string overlap, and a recurring "GRAT" tag that appears both in FlockWiper's PDB debug paths (A:\GRAT\CWipeNew\Release\CWipeNew.pdb and E:\files
ew\GRAT\CWipe\Release\CWipe.pdb) and throughout GigaWiper's internal function names — indicating the existence of an undiscovered "GRAT" development framework shared across the toolset. Google Threat Intelligence Group and Binary Defense track the family as BLUERABBIT and assess it, per Binary Defense reporting, as an Iran-nexus cluster targeting Israeli organizations, part of the same operational grouping that deployed BLUEWIPE and SEWERGOO in June 2025. Microsoft's own reporting declines to attribute a specific nation-state. Binary Defense first observed BLUERABBIT samples in March 2026; Microsoft dates the destructive activity itself to October 2025.
Operationally, GigaWiper communicates over RabbitMQ (AMQP) for command tasking — using a fanout exchange named "All" for broadcast commands and a topic exchange named "Topic" for targeted commands managed via Command 8's bind/unbind routing — and over Redis on non-standard ports for status/result reporting (fields: error, target_ip, task_id, target_computer_name, output, pwd, time, status, work_status). Both channels use an encrypted, hard-coded AES configuration. Data can be exfiltrated via a bundled MinIO client (Command 4). Persistence is established via a scheduled task named "OneDrive Update" that runs every minute plus at startup, with execution counts tracked in HKCU\SOFTWARE\OneDrive\Environment; the implant masquerades a firewall rule as "Microsoft.Windows.CloudExperienceHost" to cloak its VNC-like remote-desktop command (Command 20).
The destructive tier gives the operator three distinct escalation levers on a single infected host: Command 1 (WipeMain) enumerates physical drives via WMI, removes non-Windows-drive partition metadata via IOCTL_DISK_CREATE_DISK, and overwrites raw sectors in 0xA00000-byte chunks with a randomized (or fallback constant "1") first byte and zero-padded remainder, then forces an immediate zero-delay reboot; Command 2 triggers a BSOD via registry/boot-file deletion; Command 3 (RanMain/BigBangExtortMain) performs AES-CBC encryption in chunks with a randomly generated key/IV that is never persisted anywhere (making the encryption cryptographically unrecoverable — a "fake ransomware" that drops no ransom note and excludes .exe/.dll from encryption, deleting originals after encrypting), applying the .candy extension and dropping ./image_danger.jpg as a wallpaper; Command 12 (WipeCMain) performs FlockWiper-style multi-pass secure wiping restricted to the Windows drive — pass 1 zeros, pass 2 0xFF bytes, pass 3 random bytes, with inter-pass timing reported back to the operator.
Espionage/management tradecraft incl
Target sectors: government administration, criticalinfrastructure, energy, waterutilities, unspecifiedgeneral
Target regions: israel, Middle East
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 32 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1059.001, T1047, T1053.005, T1547.005, T1071.002, T1571, T1219, T1021.005, T1561.002, T1485